The vast number of devices and the complexity of requirements present significant challenges in ensuring the security of Non-Terrestrial Internet of Things (NT-IoT). Although existing studies have proposed methods like to defend against data theft and network interference attacks, there is still a need for more in-depth research on detecting data-level attacks in NTNs. Moreover, the vast and diverse nature of network traffic presents significant challenges in traffic modeling and feature extraction. Hypergraph neural networks have gained considerable attention because of capabilities in data modeling and feature extraction. However, most existing hypergraph neural networks are tailored for specific applications and are not adaptable to the detection of malicious encrypted traffic. To address these challenges, we firstly propose a hypergraph neural network-based malicious encrypted traffic detection framework to enhance the resilience of NT-IoT, enabling attack detection across unmanned aerial vehicles, base stations and satellites. Then, we introduce a Multidimensional Encrypted Traffic HyperGraph Network (METHGN). METHGN models the encrypted traffic from network, connection and time dimensions using hypergraph and uses hypergraph convolution network to extracts and fuse features. We conducted comparative experiments on IoT and The Onion Router Network encrypted traffic datasets for different classification tasks. Extensive experiments demonstrate the effectiveness and superiority of our approach.

Uncrewed aerial vehicle (UAV) networks are increasingly exposed to widespread and various network attacks due to their fully distributed nature and the limited defensive capabilities of individual devices. Existing defense strategies rely on network connectivity and UAV status information, which overlook information of network traffic. Malicious traffic detection offers a promising solution to achieve fine-grained attack detection. However, the dynamic nature and complexity of UAV networks limit the effectiveness of traditional traffic detection methods. Current approaches either fail to fully exploit the raw characteristics of traffic or do not consider the timeliness requirements of UAV networks. To address these challenges, we propose a novel twin graph encoder neural network, which can extract features of raw traffic bytes for efficient traffic detection. First, we propose a decoupled architecture for model training and inference to enable efficient detection of malicious traffic in UAV networks. Second, we propose a novel modeling method that models traffic as the co-occurrence graph and word frequency graph based on raw bytes. Then, we propose TGE-ETD, a Twin Graph Encoder for Encrypted Traffic Detection. TGE-ETD consists of a set of twin graph encoders that effectively extract intrinsic traffic features from graphs constructed from raw bytes. In addition, TGE-ETD employs a global attention pooling mechanism to effectively distinguish the feature contributions of different bytes. Finally, we conducted extensive experiments on a real UAV traffic dataset and four real-world network traffic datasets. TGE-ETD achieved an improvement of 1%-20% over the baseline methods by reducing the number of parameters by 20 times. Tested on multiple UAV hardware devices, TGE-ETD can achieve millisecond-level traffic detection.

Backdoor attacks pose a serious and emerging threat to deep neural networks. By injecting trigger-labeled samples into the training data, these attacks cause compromised models to misclassify any input containing the trigger. Existing defenses typically rely on either recovering the trigger to remove the corresponding backdoor or performing additional fine-tuning to erase the backdoor functionality while retaining the legitimate functionality. Both strategies require access to a trusted clean dataset, an assumption that is often unrealistic in practice. We introduce Double-Blind Cleanser (DBC), a backdoor unlearning framework that eliminates the need for trigger recovery or poisoned sample identification. DBC operates in two phases. It first leverages catastrophic forgetting to eliminate the backdoor behavior. It then applies Sharpness-Aware Minimization (SAM) to flatten the loss landscape, improving generalization and restoring legitimate functionality without requiring prior knowledge of triggers or poisoned samples. To further enhance the flatness of the loss landscape, DBC employs an importance sampling strategy that prioritizes samples most sensitive to weight perturbations, effectively reducing the impact of poisoned instances. Extensive evaluations demonstrate that DBC neutralizes diverse backdoor attacks while maintaining model utility. Its superior performance achieved first place in the mitigation round of the TrojAI competition, a multi-year, multi-round benchmark for backdoor defense.

Data valuation provides a principled framework for quantifying the contribution of data to model training. It plays a crucial role in trustworthy machine learning (ML) by supporting data curation, enhancing interpretability, and enabling fair incentive mechanisms in data markets. Shapley value is a popular method for data valuation, but accurate estimation remains computationally expensive, particularly at the dataset level. In this paper, we introduce Ensemble Shapley, an efficient framework tailored for dataset-level valuation on the sharded structure. To reduce the computational costs, we propose a two-phase estimation method that apportions the intensive contribution computation costs across disjoint data shards and strategically reuses the computation results, achieving efficient contribution evaluation through the ensemble of shard models. However, weak shard models trained on noisy data may degrade ensemble models’ performance. To solve this, we introduce a behavior-driven guided sampling method that pairs noisy datasets with benign ones, ensuring reliable contribution estimates despite the noise. We also derive an advantageous lower bound for the number of evaluation iterations that balances efficiency and accuracy by the number of shards. Experimental results show Ensemble Shapley has superior efficiency over existing methods while maintaining comparable accuracy across various ML tasks, and demonstrates strong scalability and integration potential.

The large number of devices and complex communication requirements pose challenges to ensuring the security of Non-Terrestrial Internet of Things (NT-IoT). The large-scale data and complex communication requirements make accurate detection of malicious traffic even more challenging in NT-IoT. Hypergraph neural networks have strong performance in extracting multi-relational features. However, most existing hypergraph neural networks are tailored for graph data, and hyperedge construction methods are not well-suited. To address these challenges, we propose a malicious encrypted traffic detection method based on a hypergraph neural network. First, we propose an efficient hypergraph construction method for encrypted traffic named JointKNN. JointKNN calculates the Euclidean distance between traffic flows and adds the target nodes into the neighbor sets to form the hyperedges. Then, we propose an Encrypted Traffic HyperGraph Convolution Network (ETHGCN), which takes the encrypted traffic hypergraph as the input. ETHGCN extracts and fuses both connection and temporal features to accurately detect malicious traffic. We conduct comparative experiments on IoT and Onion Network encrypted traffic datasets for multi-class and binary classification tasks. Results indicate that ETHGCN achieves an accuracy exceeding 99.8% in IoT tasks and demonstrates an improvement of nearly 20% in Onion Network tasks.

Quantum Federated Learning (QFL) has emerged as a promising research direction by combining the strengths of quantum computing and federated learning. However, existing QFL solutions have consistently failed to simultaneously improve client training efficiency and ensure communication security. In this paper, we present a novel Multi-qubit Broadcast-based QFL framework (MB-QFL) to address the efficiency and security challenges of existing approaches. The framework employs a novel multi-qubit broadcast protocol and a quantum average method to secure the information transmission process. The multi-qubit broadcast protocol overcomes the limitations of existing protocols by allowing the transmission of an arbitraryS-qubit state from one sender to multiple (Q) receivers, whereas earlier protocols were restricted to broadcast one or two qubit state to recipients. Additionally, we propose an averaging method for quantum states, which exploits the probabilistic cloning technique to achieve aggregation in MB-QFL. The security analysis demonstrates that MB-QFL can effectively protect against inference attacks from malicious clients, as well as eavesdropping and intercept-and-resend attacks during communication. The algorithm complexity of MB-QFL is significantly lower than existing QFLs. Besides, the experimental results indicate that MB-QFL achieves higher classification accuracy than other QFLs.

5G and Beyond 5G communication technologies have promoted the architectural innovation of the Industrial Internet of Things (IIoT) and the wide application of edge learning. As Beyond 5G technologies enhance wireless communication within IIoT, the demand for efficient, secure data management becomes paramount. Edge learning emerges as a solution for localized model training, reducing the necessity for extensive data transmission. However, this decentralization introduces vulnerabilities, particularly in data security during transmission and efficient resource utilization. To address the challenges of data scheduling for edge learning in the Wireless IIoT (WIIoT), we propose a novel architecture that leverages blockchain for secure, decentralized data scheduling and employs physically unclonable functions (PUFs)-based algorithm to ensure data integrity and confidentiality. The primary contributions consist of a task scheduling model based on blockchain, along with a data compression scheme in multiple stages combined with a data scheduling algorithm that is optimized for energy efficiency in edge learning environments. Experiments conducted on a simulated WIIoT platform comprising embedded devices validate our approach, demonstrating enhanced data security and learning efficiency which can reduce 40% in the training stage and 70% in the inference stage. Our findings contribute to the advancement of security and efficient edge learning frameworks in the context of WIIoT, addressing the intricate balance between security, efficiency, and decentralized trust.

In recent years, electric vehicles (EVs) have emerged as a promising mode of transportation. With the development of Internet of Robotic Things (IoRT) technology, charging stations are employing interconnected robots to charge EVs, automating the collection and transmission of user charging information. However, charging processes pose risks of privacy leakage to users, as malicious attackers could potentially exploit the collected charging information to infer the real identities and behavioral habits of EV users. Existing studies leverage the decentralization and anonymity of blockchain to achieve privacy-preserving charging management. Due to the increasing number of users and limited battery capacity, there is a large volume of charging requests demand to be processed. However, the consensus mechanism of blockchain limits the system throughput. Therefore, it is a challenge to preserve the privacy of EV users and simultaneously improve the system processing efficiency. To address these concerns, we propose an efficient and privacy-preserving EV charging scheme (EPDB), which leverages decentralized identifier (DID) and Pedersen commitment scheme to achieve reliable charging reservations while hiding EV User’s charging information. Additionally, we propose an efficient blockchain consensus protocol, which serves as the underlying storage for DID, thus significantly improving the system throughput. Furthermore, our proposed consensus protocol maintains high throughput even when encountering Byzantine attacks. Our theoretical analysis indicates that EPDB scheme effectively mitigate Byzantine attacks, preserve privacy and prevents deception of charging services, and our experimental results demonstrate the high efficiency of EPDB scheme.

Maritime ships and ports have become increasingly digital and intelligent. While intelligent maritime transportation systems bring convenience to the maritime industry, ship operation and management are also confronted with network risks. The Internet of Things (IoT) installed in the shipborne network collects and monitors the environmental data of the whole ship. It uses the collected data to make decisions to control the ship. The threat of Local Area Network (LAN) of IoT in ships has become an emerging issue. The DNS rebinding attack is a typical attack, which can bypass firewalls and seriously threaten the marine network in security and privacy of the local IoT. DNS rebinding attacks are difficult to model and detect, due to their sophisticated characteristics. In this work, we define threat models of DNS rebinding attacks and propose an effective method for the detection of and the defense against these attacks. First, we define threat models for DNS rebinding attacks. We employ a Markov chain to model the process of DNS rebinding attacks. With the threat modeling, the attack behaviors are clearly characterized and the most relevant attributes are thus extracted. Second, we propose an effective method for the detection of DNS rebinding attacks in the marine transportation system. The detection method includes the initialization method and the verification method, which manages and verifies access permission of equipment information and the service interface of the IoT in the shipborn network. Finally, we simulate the DNS rebinding attacks on the marine IoT. We analyze and test the security and the performance of the initialization method and the verification method in the simulated environment. The extensive experimental results demonstrate that the IoT in marine networks is vulnerable to DNS rebinding. Our method is effective and efficient to detect and defend against DNS rebinding attacks. It thus secures security and privacy in the local IoT on shipboard.